{"id":119554,"date":"2024-08-21T09:43:00","date_gmt":"2024-08-21T07:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot"},"modified":"2024-08-21T09:43:00","modified_gmt":"2024-08-21T07:43:00","slug":"oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","title":{"rendered":"Chyba p\u0159i aktualizaci na Windows zablokovala boot Linuxu p\u0159i pou\u017eit\u00ed UEFI Secure Boot.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V aktualizaci opera\u010dn\u00edho syst\u00e9mu Windows, kterou v \u00fater\u00fd vydala spole\u010dnost Microsoft, byla objevena chyba vedouc\u00ed k nemo\u017enosti spu\u0161t\u011bn\u00ed Linuxov\u00fdch syst\u00e9m\u016f nainstalovan\u00fdch na stejn\u00e9m po\u010d\u00edta\u010di vedle Windows. P\u0159\u00ed\u010dinou probl\u00e9m\u016f je oprava zam\u011b\u0159en\u00e1 na odstran\u011bn\u00ed star\u00e9 zranitelnosti (CVE-2022-2601) v bootloaderu GRUB, kter\u00e1 byla opravena v roce 2022. Spole\u010dnost Microsoft dosud nezve\u0159ejnila \u017e\u00e1dn\u00e9 prohl\u00e1\u0161en\u00ed t\u00fdkaj\u00edc\u00ed se tohoto probl\u00e9mu a nijak ho nekomentovala. <\/p>\n

V pozn\u00e1mce k t\u00e9to zm\u011bn\u011b bylo uvedeno, \u017ee oprava zaji\u0161\u0165uj\u00edc\u00ed zaveden\u00ed nov\u00e9 politiky SBAT (UEFI Secure Boot Advanced Targeting) bude aplikov\u00e1na na syst\u00e9my, kter\u00e9 pou\u017e\u00edvaj\u00ed pouze Windows, a nezas\u00e1hne konfigurace s dvoj\u00edm spu\u0161t\u011bn\u00edm (zm\u011bna zablokovala mo\u017enost pou\u017e\u00edv\u00e1n\u00ed zav\u00e1d\u011bc\u00edch obraz\u016f se star\u00fdm GRUB k obch\u00e1zen\u00ed Secure Boot na syst\u00e9mech s nainstalovan\u00fdm pouze Windows). Bylo tak\u00e9 uvedeno, \u017ee zm\u011bna m\u016f\u017ee zp\u016fsobit probl\u00e9my se spu\u0161t\u011bn\u00edm iso-obraz\u016f star\u00fdch syst\u00e9m\u016f dod\u00e1van\u00fdch se zranitelnou verz\u00ed GRUB. Ve skute\u010dnosti se v\u0161ak probl\u00e9my objevily i u u\u017eivatel\u016f syst\u00e9m\u016f s dvoj\u00edm spu\u0161t\u011bn\u00edm, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed nov\u00e9 distribuce Linuxu, jako jsou Ubuntu 24.04 a Debian 12.6, kde byla zranitelnost v GRUB ji\u017e d\u00e1vno odstran\u011bna. <\/p>\n

Probl\u00e9m se projevuje zastaven\u00edm procesu na\u010d\u00edt\u00e1n\u00ed s v\u00fdpisem zpr\u00e1vy \u201eVerifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation\u201c. Jako zp\u016fsob obnoven\u00ed funk\u010dnosti se doporu\u010duje odstranit v UEFI ulo\u017een\u00e1 data SBAT. K tomu lze deaktivovat Secure Boot v BIOSu, na\u010d\u00edst novou Linuxovou distribuci s podporou UEFI Secure Boot, nap\u0159\u00edklad Ubuntu, a prov\u00e9st v konzoli p\u0159\u00edkaz \u201emokutil \u2013set-sbat-policy delete\u201c, pot\u00e9 restartovat Linuxovou distribuci pro nastaven\u00ed spr\u00e1vn\u00e9 politiky SBAT. N\u00e1sledn\u011b je mo\u017en\u00e9 re\u017eim Secure Boot v BIOSu op\u011bt aktivovat. <\/p>\n

Mechanismus SBAT byl vyvinut spole\u010dnost\u00ed Red Hat ve spolupr\u00e1ci se spole\u010dnost\u00ed Microsoft za \u00fa\u010delem blokov\u00e1n\u00ed zranitelnost\u00ed v bootloaderu GRUB a vrstv\u00e1ch shim bez nutnosti odvol\u00e1n\u00ed digit\u00e1ln\u00edho podpisu. SBAT zahrnuje p\u0159id\u00e1n\u00ed dodate\u010dn\u00fdch metadat do spustiteln\u00fdch soubor\u016f komponent UEFI, kter\u00e1 obsahuj\u00ed informace o v\u00fdrobci, produktu, komponent\u011b a verzi. Uveden\u00e1 metadata jsou digit\u00e1ln\u011b podeps\u00e1na a mohou b\u00fdt samostatn\u011b zahrnuta do seznam\u016f povolen\u00fdch nebo zak\u00e1zan\u00fdch komponent pro UEFI Secure Boot. SBAT umo\u017e\u0148uje blokovat pou\u017e\u00edv\u00e1n\u00ed digit\u00e1ln\u00edho podpisu pro jednotliv\u00e9 \u010d\u00edsla verz\u00ed komponent bez nutnosti odvol\u00e1n\u00ed kl\u00ed\u010d\u016f pro Secure Boot. <\/p>\n

Blokov\u00e1n\u00ed zranitelnost\u00ed pomoc\u00ed SBAT nevy\u017eaduje pou\u017eit\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f UEFI (dbx), ale prov\u00e1d\u00ed se na \u00farovni nahrazen\u00ed intern\u00edho kl\u00ed\u010de pro generov\u00e1n\u00ed podpis\u016f a aktualizaci GRUB2, shim a dal\u0161\u00edch dod\u00e1van\u00fdch distribu\u010dn\u00edch bootovac\u00edch artefakt\u016f. P\u0159ed zaveden\u00edm SBAT bylo aktualizov\u00e1n\u00ed seznamu odvolan\u00fdch certifik\u00e1t\u016f (dbx, UEFI Revocation List) nezbytnou podm\u00ednkou pro \u00fapln\u00e9 blokov\u00e1n\u00ed zranitelnosti, proto\u017ee \u00fato\u010dn\u00edk, nez\u00e1visle na pou\u017e\u00edvan\u00e9m opera\u010dn\u00edm syst\u00e9mu, mohl pro kompromitaci UEFI Secure Boot vyu\u017e\u00edt bootovac\u00ed m\u00e9dium se starou zranitelnou verz\u00ed GRUB2, podepsanou digit\u00e1ln\u00edm podpisem.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a \u041e\u0421 Windows \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Linux-\u0441\u0438\u0441\u0442\u0435\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441 Windows. \u041f\u0440\u0438\u0447\u0438\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-2601) \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0435 GRUB, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 2022 \u0433\u043e\u0434\u0443. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u043a\u0430 \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u043c \u0441\u0431\u043e\u0435\u043c \u0438 \u043d\u0438\u043a\u0430\u043a \u0435\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119554","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Chyba v aktualizaci Windows zablokovala bootov\u00e1n\u00ed Linuxu p\u0159i pou\u017eit\u00ed UEFI Secure Boot | ProHoster","description":"Ve vyd\u00e1n\u00ed od spole\u010dnosti Microsoft v \u00fater\u00fd bylo identifikov\u00e1no probl\u00e9m, kter\u00fd br\u00e1n\u00ed bootov\u00e1n\u00ed Linuxov\u00fdch syst\u00e9m\u016f nainstalovan\u00fdch na stejn\u00e9m po\u010d\u00edta\u010di paraleln\u011b s Windows.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a Windows \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 Linux \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 UEFI Secure Boot | ProHoster","og:description":"\u0412 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u043c \u0432\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a \u041e\u0421 Windows \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Linux-\u0441\u0438\u0441\u0442\u0435\u043c, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441 Windows.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/oshibka-v-obnovlenii-k-windows-blokirovala-zagruzku-linux-pri-ispolzovanii-uefi-secure-boot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-21T07:43:00+00:00","article:modified_time":"2024-08-21T07:43:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119554","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 06:03:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:03:19","updated":"2026-01-23 06:03:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/119554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=119554"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/119554\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=119554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=119554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=119554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}